c17536650e
Flake lock file updates:
• Updated input 'nix-index-database':
'github:Mic92/nix-index-database/5a3ff8c1a09003f399f43d5742d893c0b1ab8af0?narHash=sha256-77jL5H5x51ksLiOUDjY0ZK8e2T4ZXLhj3ap8ETvknWI%3D' (2025-11-30)
→ 'github:Mic92/nix-index-database/4194c582d0a3f440382ee00b729ea5cc5ef59754?narHash=sha256-5t3d655GqLblE%2Bp5xN5ntkeRfZBesN7vehOWcRcU88M%3D' (2025-12-07)
• Updated input 'nixpkgs-unstable':
'github:NixOS/nixpkgs/418468ac9527e799809c900eda37cbff999199b6?narHash=sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y%3D' (2025-12-02)
→ 'github:NixOS/nixpkgs/f61125a668a320878494449750330ca58b78c557?narHash=sha256-BmPWzogsG2GsXZtlT%2BMTcAWeDK5hkbGRZTeZNW42fwA%3D' (2025-12-05)
• Updated input 'nur':
'github:nix-community/NUR/eb63a9ea4762aa8bd5c6a2081e5ae5c5c3495ac5?narHash=sha256-xBzrA64HTZ9OSRgs2O%2B5l2QXK0LZLijE5l73v33nGBg%3D' (2025-12-06)
→ 'github:nix-community/NUR/e48f4f829abe9a788eb0ae07853b843dd4b7adbd?narHash=sha256-459PkXCACaeWBYsxsQePi9i7aTtQ%2B8NLtnLKXEq3wVA%3D' (2025-12-07)
• Updated input 'nur/nixpkgs':
'github:nixos/nixpkgs/418468ac9527e799809c900eda37cbff999199b6?narHash=sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y%3D' (2025-12-02)
→ 'github:nixos/nixpkgs/f61125a668a320878494449750330ca58b78c557?narHash=sha256-BmPWzogsG2GsXZtlT%2BMTcAWeDK5hkbGRZTeZNW42fwA%3D' (2025-12-05)
• Updated input 'pre-commit-hooks':
'github:cachix/pre-commit-hooks.nix/50b9238891e388c9fdc6a5c49e49c42533a1b5ce?narHash=sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh%2BM4Qc%3D' (2025-11-24)
→ 'github:cachix/pre-commit-hooks.nix/548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c?narHash=sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ%3D' (2025-12-06)
Config
Flakes:
$ deploy --interactive '#fwminex'
$ nix build .#deploy.nodes.fra1-c.profiles.system.path
Other:
$ nix build .#nixosConfigurations.vno3-rp3b.config.system.build.toplevel
$ nix eval .#nixosConfigurations.fwminex.config.services.nsd
$ nix why-depends .#nixosConfigurations.vno1-gdrx.config.system.build.toplevel .#legacyPackages.x86_64-linux.mbedtls_2
Encoding host-only secrets
Encode a secret on host:
rage -e -r "$(cat /etc/ssh/ssh_host_ed25519_key.pub)" -o secret.age /path/to/plaintext
Decode a secret on host (to test things out):
rage -d -i /etc/ssh/ssh_host_ed25519_key secret.age
Borg
BORG_PASSCOMMAND="cat /run/agenix/borgbackup-fwminex" borg --remote-path=borg1 list zh2769@zh2769.rsync.net:fwminex.jakst.vpn-home-motiejus-annex2